ANS-C01 Network Implementation Practice Question
A network engineer is designing a highly available VPN connectivity between an on-premises data center and AWS. The company has two AWS Direct Connect connections terminated on two different AWS Direct Connect locations for redundancy. The company wants to use AWS Site-to-Site VPN as a backup for Direct Connect. The VPN connections will terminate on a single Virtual Private Gateway (VGW) attached to a VPC. The on-premises network has two customer gateways (CGWs) each with a unique BGP ASN. Which TWO actions should the engineer take to ensure automatic failover and load balancing? (Choose two.)
⚠ Common exam trap
It's easy for candidates to think a single customer gateway with two tunnels provides sufficient redundancy, but the question requires two separate customer gateways (each with a unique BGP ASN) to match the two Direct Connect locations and achieve true path diversity and automatic failover.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the VPN connections to use BGP dynamic routing.
Using BGP dynamic routing for the VPN connections allows automatic failover and load balancing. BGP enables the VPN connections to advertise routes dynamically, and with two VPN connections from different CGWs to the same VGW, BGP can perform active/active load balancing by establishing multiple BGP sessions. If one Direct Connect or VPN connection fails, BGP withdraws the routes, and traffic automatically shifts to the remaining active paths without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure the VPN connections to use BGP dynamic routing.
Why this is correct
BGP allows automatic route propagation and failover.
- ✗
Set up a CloudWatch alarm to trigger an AWS Lambda function that changes route table entries upon VPN failure.
Why it's wrong here
This is overly complex and not needed with BGP.
- ✗
Configure the VPN connections to use static routes with equal cost multipath (ECMP).
Why it's wrong here
Static routes do not provide automatic failover detection.
- ✗
Use a single customer gateway with two separate tunnels to the virtual private gateway.
Why it's wrong here
Single CGW is a single point of failure.
- ✓
Create two VPN connections, each from a different customer gateway to the same virtual private gateway.
Why this is correct
Two separate tunnels from different CGWs provide redundancy.
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.